# CD — build/push image vers le registry OCI Forgejo (pilote Phase 6).
# Même syntaxe GitHub/Forgejo. Le job Docker ne tourne que sur Forgejo
# (le miroir GitHub n'existe pas encore ; Docker Hub = job ultérieur).
#
# Image job = node:22-bookworm. DinD = sidecar 8 Gio (MPC-ADR-052).
# Push via Tailscale (runner hostAlias git.gregoiremureau.com → NAS),
# pas Cloudflare (limite body 100 Mo).

name: CD

on:
  push:
    branches: [main]
    paths:
      - "deployment/api/**"
      - ".github/workflows/cd.yml"
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  build-and-push:
    if: contains(github.server_url, 'gregoiremureau.com')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Docker CLI (client only) + daemon DinD
        run: |
          set -eu
          apt-get update
          apt-get install -y --no-install-recommends ca-certificates curl
          curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz \
            | tar -xz -C /tmp
          install /tmp/docker/docker /usr/local/bin/docker
          docker version
          docker info

      - name: Login registry Forgejo
        run: |
          set -eu
          REGISTRY="${GITHUB_SERVER_URL#https://}"
          # GITHUB_TOKEN : login OK mais push → unauthorized: reqPackageAccess
          echo "${{ secrets.PACKAGE_TOKEN }}" | docker login "${REGISTRY}" -u "${GITHUB_ACTOR}" --password-stdin

      - name: Build and push
        run: |
          set -eu
          REGISTRY="${GITHUB_SERVER_URL#https://}"
          IMAGE="${REGISTRY}/openclassroom-ai/oc-p07-sentiment-api"
          SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-12)"
          # Client docker statique sans plugin buildx → builder classique.
          export DOCKER_BUILDKIT=0
          docker build \
            -t "${IMAGE}:${SHORT_SHA}" \
            -t "${IMAGE}:latest" \
            -f deployment/api/Dockerfile \
            deployment/api
          docker push "${IMAGE}:${SHORT_SHA}"
          docker push "${IMAGE}:latest"
          echo "pushed ${IMAGE}:${SHORT_SHA} and :latest"

      - name: Push Docker Hub (si secrets présents)
        env:
          DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
          DOCKER_HUB_TOKEN: ${{ secrets.DOCKER_HUB_TOKEN }}
        run: |
          set -eu
          if [ -z "${DOCKER_HUB_TOKEN:-}" ] || [ -z "${DOCKER_HUB_USER:-}" ]; then
            echo "Pas de secrets DOCKER_HUB_* : skip (prod k3s reste sur l'image Docker Hub existante)."
            exit 0
          fi
          echo "${DOCKER_HUB_TOKEN}" | docker login docker.io -u "${DOCKER_HUB_USER}" --password-stdin
          SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-12)"
          SRC="${GITHUB_SERVER_URL#https://}/openclassroom-ai/oc-p07-sentiment-api"
          DST="docker.io/${DOCKER_HUB_USER}/sentiment_api"
          docker tag "${SRC}:latest" "${DST}:latest"
          docker tag "${SRC}:latest" "${DST}:${SHORT_SHA}"
          docker push "${DST}:latest"
          docker push "${DST}:${SHORT_SHA}"
          echo "pushed ${DST}:latest"